0

I noticed that despite the imagebase for win32 executables be 0x400000, Ida Pro only starts the analysis at 0x401000. What is before that and how can I change IDA's settings to start the analysis at the imagebase? Thank you.

  • Typically there is nothing before that. You might as well ask "what's before 400000h". The code section starts at +1000h. – usr2564301 Jan 30 '15 at 8:53
5

PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called IMAGE_NT_HEADERS, and a section table. A normal PE has no 32-bit/64-bit executable code there, so IDA doesn't load the header block unless you check "manual load".

Relevant resources:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.